REMARKS/ARGUMENTS 

This paper is being provided in response to the Final Office Action dated March 1, 2006 
for the above-referenced application. 

The rejection of Claims 1-4, 22-25 and 41-44 and 46-52 under 35 U.S.C. § 102(e) as 
being unpatentable over Waldin et al (U.S. Patent No. 6,094,73 1 hereinafter referred to as 
"Waldin") is hereby traversed and reconsideration thereof is respectfully requested. Applicant 
respectfully submits that Claims 1-4, 22-25 and 41-44 and 46-52 are patentable over the cited 
reference. 

Claim 1 recites a computer implemented method of scanning a storage device for viruses, 
comprising: determining physical portions of the storage device that have been modified since a 
previous virus scan using information about the physical portions without using information 
about a file structure, a file system, or a file type; and scanning at least parts of the physical 
portions for viruses, wherein scanning is performed without using information about a file 
structure, a file system, or a file type. Claims 2-4 depend from Claim 1. 

Claim 22 recites a computer program product for scanning a storage device for viruses, 
the computer program product including a computer-readable medium with executable code 
stored thereon for: determining physical portions of the storage device that have been modified 
since a previous virus scan using information about the physical portions without using 
information about a file structure, a file system, or a file type; and scanning at least parts of the 
physical portions for viruses, wherein the scanning is performed without using information about 
a file structure, a file system, or a file type. Claims 23-25 depend from Claim 22. 
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Claims 41 recites an antivirus unit, comprising: means for coupling to at least one storage 
device; means for determining physical portions of the storage device that have been modified 
since a previous virus scan using information about the physical portions without using 
information about a file structure, a file system, or a file type; and means for scanning at least 
parts of the physical portions for viruses, wherein scanning is performed without using 
information about a file structure, a file system, or a file type. Claims 42-44 and 46-52 depend 
from Claim 41. 

Waldin discloses a system, method and computer readable medium for examining a file 
associated with an originating computer to determine whether a virus is present within the file. 
(See Abstract). Waldin discloses scanning a file and placing into a critical sectors file the 
identification number of each sector that is scanned. As each sector is operated upon, a hash 
value is calculated for that sector and inserted into the critical sectors file along with the size of 
the file scanned. (Col. 4, Lines 52-64; Figures 1 and 2). Waldin discloses determining hash 
values for only those sectors of a file actually retrieved by module 5 of Figure 1. Module 3 of 
Waldin' s Figure 1 always scans the same set of sectors of a file unless the file changes in length 
or the contents of those sectors changes in some way. The antivirus accelerator module 5 
automatically hashes all sectors scanned by module 3 in the same way regardless of contents of 
the sectors. No new parser of hasher coding needs to be performed and incorporated into module 
5 to support new file formats. (Col. 7, Line 35-Col. 8, Line 2). 

Claim 1 is neither disclosed nor suggested by the references, taken separately or in 
combination, in that the references neither disclose nor suggest a computer implemented method 
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of scanning a storage device for viruses, comprising: determining physical portions of the 
storage device that have been modified since a previous virus scan using information about 
the physical portions without using information about a file structure, a file system, or a file 
type; and scanning ... wherein scanning is performed without using information about a file 
structure, a file system, or a file type, as set forth in Claim 1 . 

As support for disclosing determining physical portions of the storage device that have 
been modified since a previous virus scan using information about the physical portions 
without using information about a file structure, a file system, or a file type, the Office Action 
at Page 3 relies on Waldin, Col. 2, Lines 57-64, Col 6, Lines 37-47, and Col. 3, Lines 5-45. 
Col 2, Lines 57-64 disclose that it is advantageous to scan files once and store relevant 
information about the files, including a hash value of the file. The next time the file is scanned, 
the hash value is looked up and matched against the current hash value for the file. If the hash 
values match, then the file need not be rescanned. Applicant respectfully submits that this 
citation of Waldin explicitly discloses determining and using file hash values, and that 
information about the file structure, file system or file type is needed to determine the disclosed 
hash value. Without such information, for example, it appears that Waldin cannot determine the 
location of the file and other information needed to compute the hash values for the files. Col. 6, 
Lines 37-47 of Waldin state that if the sizes, dates and version numbers match, it is determined 
what file sectors have previously been scanned. The hash values for each of these prescanned 
sectors are determined and compared against the prestored hash values. If any computed hash 
values fail to match corresponding prestored hash values for that sector, the entire file is 
rescanned for viruses. Applicant respectfully submits that this citation of Waldin uses size, date 
and version number information about a file which is information about the file structure, file 
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system or file type. The particular sectors mentioned in the foregoing citation of Waldin are 
determined using information about the file structure, file system or file type since these sectors 
are those for a particular file. Without use of such information, Applicant respectfully submits 
that Waldin cannot determine the appropriate sectors for the file. Col. 3, Lines 5-45 of Waldin 
discuss the prior art techniques and disclose using a parser for identifying critical portions of a 
file, e.g., distinguishing between executable code and data. Different parsers are needed for 
different file types, such as DOS .exe files, Word documents, and Excel. After the parser has 
determined what are the critical portions of a file for purposes of antivirus protection, a hasher 
can be built to create the hash values based upon the critical portions of the file. Waldin 
discloses using a minimal set of sectors for the file in question being processed. The foregoing 
citation of Waldin discloses determining hash values for files of different file types. In prior art 
techniques, the particular file type is needed to determine the particular parser to use. In order 
for the parser of the prior art to operate, information about the file structure is needed. Waldin' s 
use of hash values for a minimal set of sectors for a file utilizes information about the file, such 
as from the file system, in order to determine the sectors and operate on the file. Applicant 
respectfully submits that each of the forgoing citations of Waldin uses information about a file 
structure, file system or a file type. 

As support for disclosing scanning ... wherein scanning is performed without using 
information about a file structure, a file system, or a file type, the Office Action at page 3 
relies on Waldin Col. 6, Lines 43-46, Col. 7, Lines 37-46, Col. 7, Line 64-Col. 8, Line 8, and 
Col. 3, Lines 5-45. Col 6. Lines 43-46 of Waldin are discussed above as disclosing that if any 
computed hash values fail to match corresponding prestored hash values for that sector, the 
entire file is rescanned for viruses. Applicant respectfully submits that the foregoing citation 
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states that the file is scanned. In order to perform such a scan, information about the file is used 
by Waldin. As an example, in order for Waldin to scan a file, the storage locations associated 
with the file are needed. Without the storage location as may be obtained, for example, using file 
system information, Waldin could not even determine what data to scan. Col. 7, Lines 37-46 of 
Waldin disclose determining hash values for a minimal set of sectors in a file and always 
scanning the same set of sectors unless the file changes in length, or the content of those sectors 
changes in some way. The sectors operated upon by Waldin are for a particular file. In order to 
determine the appropriate sectors, information about the file system, for example, may be used to 
determine which particular sectors are associated with the file of interest. Waldin also discloses 
scanning the same set of sectors unless the file changes in length. The length of the file as used 
by Waldin is information about the file as may be included, for example, in a file system. 
Col. 7, Line 64-Col. 8, Line 8 state that the antivirus accelerator module 5 hashes all sectors 
scanned by module 3 in the same way regardless of the contents of the sectors. No new parser or 
hasher coding needs to be performed and incorporated into module 5 to support new file formats. 
In other words, Waldin' s file scanning is performed on sectors for the file and a hash value is 
determined on a per sector basis regardless of the contents of the sectors. However, Waldin 
operates on files and as such, in order to determine the particular sectors of a file, information 
about the file such as may be included, for example, in a file system, is utilized. Col. 3, Lines 5- 
45 are discussed above and use information about a file structure, file system or a file type. 
Applicant respectfully submits that each of the forgoing citations of Waldin uses information 
about a file structure, file system or a file type. 

Waldin discloses operating on files and uses information about files. For example, 
Waldin discloses using the size of a file (see step 57, Figure 5), and scanning sectors of a file 
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(see, for example, element 1 , Figure 1 ; step 22 of Figures 2 and 4). In order to operate on files as 
disclosed in Waldin, information about the file is used by Waldin. As an example, in order for 
Waldin to scan a file, the storage locations associated with the file are needed. Without the 
storage location as may be obtained, for example, using file system information, Waldin could 
not even determine what data to scan. 

In view of the foregoing, Applicant respectfully submits that the Waldin does not teach, 
disclose or suggest the foregoing recited features of Claim L 

Applicant's independent Claims 22 and 41 recite features similar to those set forth above 
regarding Claim 1 that are neither disclosed nor suggested by Waldin. Thus, for reasons similar 
to those set forth regarding Claim 1, Applicant's Claims 22 and 41 are also neither disclosed nor 
suggested by Waldin. 

In view of the foregoing, Applicant respectfully requests that the rejection be 
reconsidered and withdrawn. 

The rejection of Claims 5-7, 26-68 and 45 under 35 U.S.C. § 103(a) as being 
unpatentable over Waldin is hereby traversed and reconsideration thereof is respectfully 
requested. Applicant respectfully submits that Claims 5-7, 26-28 and 45, as amended herein, are 
patentable over the cited reference. 

Claims 5-7 depend from Claim 1. Claims 26-28 depend from Claim 22. Claim 45 
depends from Claim 41 . For reason set forth above, Waldin neither discloses nor suggests 
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independent Claims 1, 22 and 45 and also neither discloses nor suggests Claims 5-7, 26-28 and 
45 that depend, respectively, therefrom. 



In view of the foregoing, Applicant respectfully requests that the rejection be 
reconsidered and withdrawn. 

Based on the above, Applicant respectfully requests that the Examiner reconsider and 
withdraw all outstanding rejections and objections. Favorable consideration and allowance are 
earnestly solicited. Should there be any questions after reviewing this paper, the Examiner is 
invited to contact the undersigned at 508-898-8604. 



MUIRHEAD AND SATURNELLI, LLC 
200 Friberg Parkway, Suite 1001 
Westborough, MA 01581 
Tel: (508) 898-8604 
Fax: (508) 898-8602 
Customer No.: 52427 
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• Respectfully submitted, 
MUIRHEAD AND SATURNELLI, LLC 




Anne E. Saturnelli 
Registration No. 41,290 
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